Trojan.MulDrop2.16847

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Kaseya Agent Service Helper' = '"%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'ImagePath' = '"%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe"'

Вредоносные функции:

Создает и запускает на исполнение:

%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER -Embedding -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Kaseya\Kaseya Agent.lnk
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\setua95.rra
%PROGRAM_FILES%\Kaseya\Agent\Agene5e.rra
%PROGRAM_FILES%\Kaseya\Agent\KaUse2f.rra
%PROGRAM_FILES%\Kaseya\Agent\KPrte0f.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setua76.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\layo9d9.rra
C:\KASetup.log
%TEMP%\pft3.tmp\setup.log
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setua56.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\dataa27.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\dataa08.rra
<DRIVERS>\KaPF1207.rra
%PROGRAM_FILES%\Kaseya\Agent\Kase117a.rra
%PROGRAM_FILES%\Kaseya\Agent\Kase115b.rra
<DRIVERS>\kase1255.rra
<DRIVERS>\kapf1236.rra
<DRIVERS>\Kase1226.rra
<SYSTEM32>\kase1023.rra
%PROGRAM_FILES%\Kaseya\Agent\Psapf58.rra
%PROGRAM_FILES%\Kaseya\Agent\sporf48.rra
%PROGRAM_FILES%\Kaseya\Agent\kGetecb.rra
%PROGRAM_FILES%\Kaseya\Agent\KAgefc5.rra
%PROGRAM_FILES%\Kaseya\Agent\LogPfa6.rra
%PROGRAM_FILES%\Kaseya\Agent\KEvef77.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\_IsRfe31.rra
%TEMP%\pft3.tmp\layout.bin
%TEMP%\pft3.tmp\data2.cab
%TEMP%\pft3.tmp\setup.iss
%TEMP%\pft3.tmp\ikernel.ex_
%TEMP%\pft3.tmp\setup.inx
%TEMP%\pft3.tmp\Setup.ini
%TEMP%\pft3.tmp\Setup.exe
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\Setup.bmp
%TEMP%\pft3.tmp\data1.hdr
%TEMP%\pft3.tmp\data1.cab
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\Psapfc9b.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\KSetfc6c.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\setufbb0.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\defafdd3.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\isrtfd56.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\valufcf8.rra
%CommonProgramFiles%\InstallShield\IScript\iscrd4c0.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecfbe.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iused220.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objed1d2.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctorcffd.rra